Agencies shall, to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information.

This will, as I read it, require DHS to upend it’s “mixed-use” records policy. It also throws a monkey wrench into the U.S.’s ability to work with the EU Privacy Shield. Whether or not this goes through notice-and-comment rulemaking, it will, I think, be relatively challenging for DHS (and probably DOJ and DOS) to administer.

As an attorney who has been on all sides of deportation and removal matters, I expect this will be an issue for those engaged in immigration litigation (removal proceedings, asylum applications, etc.) who seek records from DHS to support their case. If DHS will not honor Privacy Act requests from those lacking green cards, that avenue of discovery will be foreclosed. It also means that avenue for correcting erroneous information will be foreclosed. DHS has posted a FAQ page concerning its implementation of this order, but it doesn’t address this issue.

For the immigration law practitioner, this means that whether your clients hail from a “Covered Country” under the Judicial Redress Act amendments to the Privacy Act will be a matter of heightened importance going forward. . .